Unable to utilize logics apps to feed data in a watchlist

Anonymous
2021-09-09T07:41:49.22+00:00

Hey,

I am unable to add an item in my choice of watchlists using entities like an account, computer, hostname, or IP address, the step where the watchlist condition will take an input is being skipped by the logic app, can anyone help regarding this.

TIA

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
2,843 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
976 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2021-09-10T08:33:34.877+00:00

    131072-watchlistactionlogicapp.pngHey @Mike Urnun - Yep I am using that particular action, attaching pictures for reference.
    131071-watchlistlogicapp.png131028-logicappruntimedetails.png

  2. Mike Urnun 9,666 Reputation points Microsoft Employee
    2021-09-22T17:46:42.763+00:00

    Hello @Anonymous - I read your discussion on the Tech Community link and it looks like the same observation was made for the root cause of the issue. Logic Apps workflows execute in a top-down direction so the trigger is the component that is supposed to feed data to the rest of the subsequent Actions in your workflow. In your case, you're getting successful runs but yet no data is flowing through your workflow.

    As such, in order to investigate further and as the next step, I recommend that you carefully review the Run History (of the successful runs of your Logic App workflow) and validate the inputs and outputs from the trigger as well as from parallel branches of actions: Entities - Get Accounts, Entities - Get Hosts, etc.

    The exact steps on how to review Trigger and Run histories separately in greater detail are on the following documentation: Monitor run status, review trigger history, and set up alerts for Azure Logic Apps

    Also, I found the following blog post which seems to be implementing a similar workflow: How to Use the Watchlists Logic App Connector for Azure Sentinel

    Let me know if you find something in the Trigger/Run History or run out of options, I'd be happy to dig deeper and help you get the workflow up and running.